{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39510", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:47:50.137Z", "datePublished": "2026-04-08T08:30:14.471Z", "dateUpdated": "2026-04-08T08:30:14.471Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "final-tiles-grid-gallery-lite", "product": "Image Photo Gallery Final Tiles Grid", "vendor": "WP Chill", "versions": [{"changes": [{"at": "3.6.12", "status": "unaffected"}], "lessThanOrEqual": "3.6.11", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jitlada | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:29:00.851Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11.</p>"}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:14.471Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/final-tiles-grid-gallery-lite/vulnerability/wordpress-image-photo-gallery-final-tiles-grid-plugin-3-6-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve"}], "title": "WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11."}], "id": "CVE-2026-39510", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:25.210", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/final-tiles-grid-gallery-lite/vulnerability/wordpress-image-photo-gallery-final-tiles-grid-plugin-3-6-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.6.11]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 99.0, "source": "matching"}]}, "original": {"product": "Image Photo Gallery Final Tiles Grid", "source": "cna", "vendor": "WP Chill"}, "product": "image_photo_gallery_final_tiles_grid", "vendor": "wpchill"}], "analysis": {"en": {"generated_at": "2026-04-08T09:21:04.983177+00:00", "value": {"mitigation_remediation": ["Check the current plugin version and upgrade to 3.6.12 or later if available; if an upgrade is not yet released, remove the plugin entirely from the site.", "Verify that WordPress and all other plugins are updated to their latest stable versions to reduce the overall attack surface.", "If upgrading or removing is not possible, restrict access to plugin URLs by configuring role\u2011based permissions or using a security plugin to block unauthorized requests."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access via IDOR"}, "threat_synthesis": {"affected_systems": "WP Chill:Image Photo Gallery Final Tiles Grid plugin, versions from the earliest available through 3.6.11 are vulnerable. Users of any earlier or later versions are not affected, but verification is recommended.", "description_and_impact": "The vulnerability is an Authorization Bypass Through User\u2011Controlled Key that allows an attacker to exploit incorrectly configured access control levels within the WordPress Image Photo Gallery Final Tiles Grid plugin. This flaw enables attackers to access resources that should be restricted, such as user\u2011uploaded media or other plugin data. Because the flaw bypasses normal authentication mechanisms, sensitive content could be disclosed, tampered with, or deleted, leading to confidentiality and integrity compromises. The weakness is identified as CWE\u2011639, which categorises it as an improper influence of authentication data.", "risk_and_exploitability": "The CVSS score is not disclosed, but the nature of IDOR flaws generally results in moderate to high risk. The EPSS score is not available and the vulnerability is not included in CISA\u2019s KEV catalog, indicating no known exploitation yet. The likely attack vector is through manipulation of URLs or form fields within the WordPress admin interface, or via authenticated user sessions that possess elevated privileges. Successful exploitation could grant attackers access to sensitive media or configuration files, potentially enabling further lateral movement within the site."}}}}, "created": "2026-04-08T19:30:32.248237+00:00", "updated": "2026-04-08T19:42:58.527992+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpchill", "wpchill$PRODUCT$image_photo_gallery_final_tiles_grid"]}